Imgproxy

Vulnérabilités associées 6

• Élevée 7.5 Unbounded memory allocation in ICO loader allows unauthenticated memory-exhaustion DoS via crafted data_size field Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader (vips/icoload.c). An attacker-controlled data_size field (u32) from the ICO directory entry is passed directly to VIPS_MALLOC without any bounds check, so a single crafted 23-byte ICO file makes an imgproxy wor... GHSA-mmq5-xm89-9pfg 03:05
• Moyenne 4.7 SVG sanitizer bypass: javascript: href on anchor elements survives sanitization Summary There is a cross-site scripting (XSS) vulnerability in imgproxy's SVG sanitization logic. When IMGPROXY_SANITIZE_SVG is enabled, the sanitizer correctly strips dangerous tags and event handler attributes, but it fails to filter javascript: scheme URIs in href attributes on <a> e... GHSA-96f3-j94p-x9jv 03:05
• Élevée 7.5 imgproxy source-address guard permits CGNAT addresses Affected product imgproxy's HTTP/HTTPS source-image fetcher when IMGPROXY_ALLOW_PRIVATE_SOURCE_ADDRESSES=false and an untrusted party can select a source URL. Summary The source-address guard permits addresses in 100.64.0.0/10 because VerifySourceNetwork relies on Go's `net.IP.I... GHSA-8w7m-q6hg-mfqm 03:05
• Élevée 7.5 imgproxy v4.0.11 custom BMP loader heap buffer overflow causes remote process crash The decoder accepts arbitrary BMP bit depths for uncompressed BI_RGB input, routes every value greater than or equal to 24 through its 24/32-bit row generator, allocates a row buffer sized for at most four bytes per pixel, and then reads a row sized from the attacker-controlled bit depth. The inco... GHSA-55vq-g34m-xp8f 03:05
• Critique 9.8 Integer overflow in ICO loader causes remote denial of service and permits remote code execution via heap buffer overflow Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original declared s... GHSA-hff9-5pqw-6w9f 03:05
• Élevée 7.5 Out-of-bounds heap read/write in ICO loader BMP header reconstruction allows unauthenticated remote worker crash Summary Out-of-bounds heap write in imgproxy's ICO loader (vips/icoload.c): when the ICO entry's image data buffer is small, the loader's BMP-header-reconstruction writes land past the allocation, corrupting the size field of the following heap chunk. The worker then aborts deterministicall... GHSA-494m-4556-wf5p 03:05